Blockchain Regulatory Glossary — 30 Legal and Compliance Terms

AML (Anti-Money Laundering)

Laws and procedures preventing proceeds from criminal activity from entering the financial system. In crypto: KYC requirements, transaction monitoring, suspicious activity reporting.

BSA (Bank Secrecy Act)

US law requiring financial institutions to assist in detecting and preventing money laundering. All MSBs (including crypto businesses) must comply with BSA regulations.

CFTC (Commodity Futures Trading Commission)

Federal agency regulating US derivatives markets. Has claimed jurisdiction over Bitcoin and other cryptocurrencies as commodities. Has brought enforcement actions against unregistered crypto derivatives platforms.

DSCSA (Drug Supply Chain Security Act)

FDA law requiring electronic traceability for all prescription drug products in the US supply chain. Lot-level traceability, 24-hour query response. Blockchain is one compliance architecture.

FinCEN (Financial Crimes Enforcement Network)

US Treasury bureau overseeing BSA compliance. All crypto businesses that exchange virtual currency for fiat or other virtual currencies must register as MSBs with FinCEN.

FSMA (Food Safety Modernization Act)

FDA law reforming US food safety. Section 204 requires enhanced traceability records for high-risk foods. Blockchain provides traceability compliance architecture.

GDPR (General Data Protection Regulation)

EU data privacy regulation. US data privacy is primarily governed by state laws (CCPA, CPRA) and sector-specific laws (HIPAA). GDPR applies to EU person data even if processed by US companies.

HIPAA (Health Insurance Portability and Accountability Act)

US healthcare privacy law. Governs protected health information (PHI). Blockchain storing PHI must comply with HIPAA Security Rule; most blockchain designs store only PHI hashes off-chain.

Howey Test

SEC's four-factor test for whether something is an 'investment contract' (and thus a security): (1) investment of money, (2) in a common enterprise, (3) with expectation of profit, (4) from the efforts of others. Most token sales satisfy all four.

ITAR (International Traffic in Arms Regulations)

US export control regime for defense articles and services. ITAR-controlled technical data cannot be exported to non-US persons without license. Enterprise blockchain for defense must be US-only.

MTL (Money Transmitter License)

State license required for entities transmitting money (including crypto) on behalf of customers. 49 states require MTLs for crypto businesses (Montana exempts most). New York requires a separate BitLicense.

MSB (Money Services Business)

Any entity exchanging currency, cashing checks, or transmitting money — including crypto exchanges. Must register with FinCEN, file SARs, and maintain AML programs.

OCC (Office of the Comptroller of the Currency)

Regulates national banks. Has issued guidance clarifying that national banks can provide crypto custody services and use stablecoins.

OFAC (Office of Foreign Assets Control)

Treasury bureau administering US economic sanctions. All crypto businesses must screen against OFAC's SDN (Specially Designated Nationals) list. Tornado Cash was sanctioned by OFAC in August 2022.

Reg A+ (Regulation A+)

SEC exemption allowing companies to raise up to $75M from all investors (not just accredited) after SEC qualification. Used for some tokenized asset offerings.

Reg D (Regulation D) 506(c)

SEC exemption allowing unlimited capital raising from verified accredited investors. Most private token sales use Reg D 506(c) for US investors. Requires investor accreditation verification.

SEC (Securities and Exchange Commission)

Federal agency regulating US securities markets. Has claimed most crypto tokens are securities. Has brought enforcement actions against crypto exchanges and token issuers.

STO (Security Token Offering)

Token sale conducted in compliance with securities regulations. Contrasted with ICOs (which were generally not registered). STOs are registered with SEC or rely on a valid exemption.